This document discusses computer system security and control. It outlines the objectives of information security as confidentiality, data integrity, and availability. It also describes various types of information security such as application security, cloud security, cryptography, and infrastructure security. Reasons why computer systems are vulnerable include increased access, disgruntled employees, complexity, cyber crimes, complacent management, and natural disasters. Controls to enhance security involve physical controls, access controls, backups, and administrative procedures.

1. Computer system security and
control

2. Information security is the protection of
computer systems and networks from theft or
damage to the hardware, software or electronic
data as well as from the disruption or
misdirection of the services they provide.

3. Objectives of information security
It focuses on three goals:
1. Confidentiality: preventing the disclosure of
information to unauthorized users.
2. Data integrity : ensuring the accuracy and
authenticity of data. Only authorized persons
may edit data and they need to follow
procedures to prevent former employees from
retaining the ability to alter company data

4. 3. Availability: authorised users should have
reliable access to information when they need it
TYPES OF INFORMATION SECURITY
1. Application security
Involves protecting software applications by
preventing, detecting and fixing bugs and
vulnerabilities

5. 2. Cloud security
Involves protections of data, applications and
infrastructures involved in cloud computing
3. Cryptography
Covers a lot of techniques for communicating
in a secure manner

6. 4. Infrastructure security
Eg data centers, internal and external
networks, desktops

7. Reasons why computer systems are
vulnerable
Increased access to the system
Disgruntled/dishonest employees
Increased system complexity
Cyber terrorism/crime on the internet or
hackers
Complacent management
Modern networked systems

8. Natural disasters
Fire
Floods
Earthquakes, wind storms and rain
lightening

9. Accidental threats
Human errors
Procedural errors
Software errors
Electromechanical problems

10. International breaches of security
Theft
Terrorism
Computer viruses
Unauthorized disclosure or access,
modification or destruction or loss of data or
information
Computer fraud

11. General controls
Physical control
Access controls or logical controls eg
passwords, biometric identification techniques
Back up
Administrative controls

12. Types of Application controls
Input controls: are computer controls designed to
provide reasonable assurance that transactions are
properly authorized before processed by the
computer, incorrect transactions are rejected.
Processing controls: provide an automated means
to ensure processing is complete, accurate and
authorized.
Output controls: address what is done with data
and should compare output results with the
intended result by checking the output against the
input

13. Internet and E-commerce challenges
Viruses: Is a malicious piece of computer code
designed to spread from device to device. Viruses
are designed to damage a device or steal data
Hackers: A security hacker is someone who
explores methods for breaching defenses and
exploiting weaknesses in a computer system or
network
Spamming: The use of messaging systems to send
multiple unsolicited messages to large numbers of
recipients for the purpose of commercial
advertising or for any prohibited purpose

14. E-commerce controls
Firewall: firewall is a network security system
that monitors and controls incoming and outgoing
network traffic based on predetermined security
rules.
Encryption: is the process of encoding
information, that is the process converts the
original representation of the information known
as plain text into an alternative form known as
cipher text. Only authorized parties can decipher a
cipher text back to plaintext and access the
original information.

15. Digital signature: is a mathematical technique
used to validate the authenticity and integrity
of message ,software or digital document.
Digital signatures are based on public key
cryptography and private key cryptography
Authentication : uses password or any
biometric technique